-: In this lesson, we're going to talk a bit
more in depth about the concept of data classifications.
Now, we've mentioned the basic concepts
previously in this course.
But now we're going to formally define them
to ensure you're ready for any questions
you get about data classifications on the exam.
Data classification is based on
the value to the organization.
And the sensitivity of that information
if it's going to be disclosed.
The person that decides the level
of data classification is the data owner.
Now, what exactly would we consider
sensitive data or information?
Well, sensitive data is any information that can result
in the loss of security or loss of advantage to a company.
Especially if it's access by unauthorized persons.
Now, basically, this is the data
that we need to be protecting.
Anything that is sensitive,
we want to make sure there is protection around it.
But, we can't protect everything equally.
And that's why we have to classify data
into several different categories.
And those that are a higher classification
are going to need more protections
and more resources spent against them.
Those that are in lower categories,
we're going to spend less on
in terms of protection and time and resources.
Now organizations need to be careful
to establish proper policies to identify
how data should be classified.
Because, one of the trends I've seen a lot
is people over classifying data.
If you over classify your data,
this is going to lead you to have to having
to protect everything at a really high level.
Which means you're going to spend a lot more money,
a lot more time, and a lot more resources
to protect that data.
This includes adding additional personnel,
additional access controls, and other technical solutions
that you're going to have to buy and deploy.
So, by classifying the data, it can than be separated
into different levels of protection
based on those classifications.
There are two different classification schemes
that are normally used by organizations.
And the way you choose yours is based on whether you're
a commercial business, or a governmental organization.
So if you're a commercial business like we are,
you're going to use one of four
common classification levels.
And these go from lowest to highest
as public, sensitive, private, and confidential.
Public data would have no impact to
your company if it's released.
And usually, this is information that's posted
in an open-source environment,
such as your website or other platforms.
For example, this course is public data
that is part of our organizational data.
We've released it to the public and anyone who pays
can get access to this material.
Than we have sensitive data.
Sensitive data might have a minimal impact if released.
Such as your organizations financial data,
or in my case, maybe the next course that I'm working on.
I wouldn't want to get it out there
before I released the course,
because I don't want my competitors to see it
and copy my material.
Next, we have private data.
Private data would contain things
like personnel records, salary information,
and any other data that's used only within the organization.
For example, you don't need to know
what the revenue is of our company,
or how much my employees make,
or what their social security numbers are.
All of that is private data that we use internally,
but none of our customers or anybody
outside our organization needs to have access to it.
Finally, we have confidential data.
And this is the highest level of classification
in the commercial realm.
This is going to contain items such as trade secrets
intellectual property data, source code,
and other types of things that are seriously going
to effect the business if it was disclosed.
So if you think about CompTIA,
one of the things that's confidential is the test questions.
They don't want all those test questions running
around the internet where you can download them,
find the answers, and then go in and take the exam
just by memorizing the test, right?
That is against their policies
and therefore they protect that data as confidential data.
Now, if you work in a military or government sector,
you're going to have five different classification levels
going from lowest to highest.
These are probably what you hear inside movies all the time.
Things like unclassified, sensitive but unclassified,
confidential, secret, and top secret.
The lowest classification is unclassified.
And unclassified data generally can be
released to the public either just in general
or under the Freedom of Information Act.
So there's actually a law in the United States
that the public has a right to know
information about their government.
And if you submit a Freedom of Information Act request
to one of the government organizations,
they have to find all of the unclassified data
that matches those terms you've asked for
and then provide it back to you.
The next category is called sensitive but unclassified data.
And this includes things like medical records,
personnel files, and other items that won't
hurt national security if released,
but they would impact those who's data
was being used inside of it.
So, for example, if you look at the military,
they have a lot of soldiers and sailors and airmen.
If I took on of their medical records
that has their birthday, their social security number,
and medical information about them,
that would be considered sensitive but unclassified.
If it gets out the Private Timmy
had a strep infection last week,
that would effect Timmy, maybe,
but it's not going to effect the military at large.
The next one we have is confidential.
Confidential data includes data such as trade secrets
and other information that can seriously effect
the government if unauthorized disclosure were to happen.
Than we get into secret data.
And secret data is going to include things like
military deployment plans, defensive postures,
and other information that could seriously
damage national security if disclosure was to happen.
Now, when I talked about confidential,
it would seriously effect us.
Now if I talk about secret, it could seriously damage us.
Finally, we have the highest classification
which is known as top secret.
Top secret data might include
the blueprints for a weapon system or other information
that would gravely damage national security
if it was known to those who weren't
authorized for this level of information.
And so you can see these classifications
get more and more serious and they
would have bigger and bigger effects to us.
And so we're willing to spend more money and more time
to protect the higher level of classification.
So, protecting data takes up a lot of resources
as I've already mentioned.
And therefore, it's really important for you to understand
the life cycle of the data as you collect it,
retain it, and eventually dispose of it.
Now, what I mean by that is that data
shouldn't be stored forever.
Your organization needs to have policies
that are going to dictate
how the data is going to be stored,
when the data is going to be stored,
and for how long it is going to be stored.
And then finally, how are you going
to destroy it when you are done with it?
For example, let's say I was going to have a course
that's going to happen next week
and you sign up to attend the course.
And you give me your information like
your credit card number, your name,
your address, your email, things like that.
How long should I keep that in my system?
Should I keep it just until you come
and show up for the course?
Or, should I keep if for the next six months?
Maybe a year, maybe five years,
maybe 20 years, maybe forever.
Well, that's going to depend on the organizational needs.
All of this should be defined in your policies.
And they should clearly be documenting
what your organizational needs are,
how long you need to keep this data,
and what the life cycle's going to look like.
Also, you need to insure that you're following
the local, state, and government laws and regulations
for data retention time requirements.
Because, depending on the type of organization you are,
you may have legal requires that say you need to maintain
certain types of data for certain periods of time.
We'll talk a little bit about those laws and regulations
in a future lesson.
(electric buzzing)